Manual uprade FTD 2100 HA

[kruko90]

Hello All,

We have a FTD 2100 HA pair managed trough FMC. According to Cisco documentation upgrading a HA pair trough FMC will go automaticly ( standby first, then active).

Is there a possibility to upgrade this manualy? ( so first standby, manual failover and then active node).

thnx for the help

[balaji.bandi]

sure you can do as per the document, also make sure your FMC also upgrades the desired version to support the final version of FTD.

you need to upgrade FMC before you upgrading FTD. (if FTD required a new version of FMC to manage).

https://community.cisco.com/t5/security-documents/firepower-threat-defense-ftd-code-upgrade-manually/ta-p/3956949

[kruko90]

Hi Balaji,

thanks for the quick reply. Is it possible to do this via FMC (gui) aswell? and yes, the FMC has already been upgraded.

and that procedure works for the 2100 series aswell?

[balaji.bandi]

Looks like you are confusing here, FMC does it own way (that is the best and tested approach)

Since you are looking at the manual process I have advised that document., so please feel free what suites your needs and comfortable to upgrade.

[kruko90]

Hi Balaji,

as far i understand manual upgrade trough FMC is not possible. Is the manual upgrade suitable for the 2100 series aswell?

the document describers 4000/9000 series.

Kind regards

[balaji.bandi]

Personally not done on FTD 21XX - I have most of them 4XXX - the procedure should work all the models, I do not see any reason here or difference between 2100 and 4100 for the upgrade.

[Chakshu Piplani]

Hi,

First you have to push the upgrade to both the units in the HA.

To do that once you have uploaded the updates to FMC, under system-->updates, you have to press the "push or stage button"

Post that go to CLI of FTD

> expert
admin@FTD67:~$ sudo su
Password:
root@FTD67:/home/admin# cd /var/sf/updates/

root@FTD67:/var/sf/updates# ls -la

#copy the name of the update file from here, to use it in the command below:

install_update.pl /var/sf/updates/Cisco_FTD_SSP_FP2K_Upgrade-6.6.1-91.sh.REL.tar --detach

#Replace "Cisco_FTD_SSP_FP2K_Upgrade-6.6.1-91.sh.REL.tar " with the file you want to install.

#Don't forget the "--detach" keyword here, without this the upgrade will start and if you close the SSH window it will get stuck there.

Once the bash returns, go to the following path:

cd /ngfw/var/log/sf

Further go in the folder of the upgrade.

cd <folder_name>

Then tail the status logs:

# tail -f status.log

Once the upgrade completes the unit will auto reboot.

Repeat for the same for the other unit, post upgrade of one unit.

Do rate helpful posts.

Regards,

Chakshu